��i�ej��lW����������_���'���L��G��:?�]O���1�|�;ϕ��0��q����1lGhہ����6���y���.�7�$0#�֘8�@�H`����p^B Ȗ�O�L���Z3)+H��:�����Nu��Ue(���%�Ⱥ���-�=�W�m��{��͆_P� � o��ד1���h� �6J̆� )?LG�diS��3�I��B@ QG2�I��<fKE:h*�] >&�ACe�����$"}�8�8��㣧�]C��M�Ӈ�Ķd=���pXV��?���} �_C������ئ� ��s��:��ۑ(1�Iꚍt!94�hT�|��GԸcLd�"a�Rh �䐭P(���_Ԋc�H'%`Br��y\��|{ ��G��m�3�l6�eҋ��fi��,�?�ai:o�cII��7'eTKF�aQ��q��tA9hy����o�~k� &�������m��G�3.��4$q�j�.�Õ�':z�� Y����7�(��KkǛ�cEb��>�W՛��-+���}p�,�����M�Z�1�~� 0�M`hG�jM�s����,������&ɕK��T�e�Z���lQ��t��6_? ���GPߖ�2���mn�_�$�Wz���A>}F�O)��{NNV�+�(���2?��a,�V�[9,�g2���qа�����`���ᥪ���k5��F�SlQ���:�Z-�4ݔj�ﬡ������|Qϛ���t����Aܖ���Ԡ ��x�٥D�bWI�t��}[�L� �o��?�e��_/ๆ�(7�*�����u+��3�o�b�)��DT5�*��aݱ�����7��斞t� ��pnj?��>�]Xh�(�� s���s/�>��|�#�V]/c���K�&B��v�ZE��%��_�����"����ґ��0�[�*����!sm�v���B�����m����k�p���S�6_ O@�ŕ�H�_���i���7q��={��>�C�}:=�&hY15��yb�������6R"M{��M�7*8L�IJ�����#V���&:?"XCM&��+��V��X��(L��o�9ӳg��A�� ~꒬~�sS�%������+�S�dk��� n.���Ob-����(���ka�ތ-%���O�q��A*?~#�k Pd<��<���d��������}r�T,�����ˮ��R�樠��,Z{m%3���L{�?�u ��� D}$i��íR���gG�1��Y����H���wlF���2O۲��0��"�@�p��\%??� �ٹ�1O�s���%+����u u�s!{�Be(#�Ԉ�V�2&#�E"X��"mY]EE�vH���=i�ur-�?Q뗐m�=u� |`��l �i0f�qb�cO�\V����q�������~K0��M���ْyލ�stF���$Ħ`�[(_l�`o�����p!d�>��o��~��OM���s�E��q�K��.��ƴGT��o��z���<W��[�~�������_��-=�O���π �36Gש3o�C��ÓP� mU�-�<� ���X�s�}2����I,���}VVh��C3�.�p�pu��n.r-Єg`:_jg��Ɵ�}��Kی��f��{�"6el�+#*"H��1PDY�P2qb�� }&���$�o�����[���e 3��r�F�K��73��jE�|_G$ɜ���\�H�8d��NA�_�!T:�Ewe~�hɌY�{?٪�Nǟ~��?�Zv���^'�@L�]�5A�ލ�@�����B_�>f�/n���o�fZ�ƙ�j�$7�o�®,�I��ʖv�>O4z��p�p&T�D�qG-��W��4S��]:�� (����Tr*�������Uk1e߈��y{����ͱ�{�M��¤����^��!%�G=�*�f����0�KO�a���iˎ,n^R��>Dž���35.m�_�����}�S���C/<������o�������>��R���s{>�ic#&t�p��9��l��#����#6qh�,���Zx�V?�\g�Df��h�%��$�~�)���D��E�H���@��8/P�1�rZ݂��ǜ����|҄T��Q�}�O���� !����Î<�t{��Ž�m(y��,EY�kf���>��[����Xo�4�4^CIf�^x��҈�RD���?��ο���<�'aT�(r�����b]�A�(+�y�����U�酕q �,J�Ԉ�~,���p�f�$��SK1�k�V &|q���*�,%?�!Ad��C�z�GY��_*f���AD`�%`�(Ґ��t���'{軀������ý�݂�Ț��?�6�g>)N���Z%�{ڌguzj%C0m�i��0_n0���2��*�P}~-�`܍��"O>���R[+Q��TMn�)}����� jl��1�1nC���E�)Jj8� ��s��UzJ����,�!0��ZFo:��}e4T����;��:#��zp��~Q��P�\���`w�\oP�.��h�61?��Z>�s� i�Ȭ�K�m%�%�-�'��e�s?-�;hm��Y{��v��-�3�U}����s�L?mJInX��R����!U��|RC�0�%$:��k�3!�u��Zj/y u�e`�/���m:1�<p�TUDI7����/f¦Ȧ�s�S]�0���k��"���\�E/B��C=��y�Q�lf������vKbq�H1! HK��:6�|��G,b�������S�v��m��y �Ы�����^�=��#6@a�j n����> ߗ�Kb�R�)h��ŝ���˿��J�k}Vr�0H�0�Z����)�G�:c�"'�M�1�z[�T�8��W�aB4����6QS��":��M�o��i�e�@�8茂���j��-�jv�2� ne5ܱ���٬�dT?Rπ#�>�IJ��C�W������ʕn(F� �v��&�G����������dG2����ٝ:_���.<��0��WC�����@�q")�D�W'K.P�����}.p�H��L��;�2��b�E�TǫoJ=�h?�s�RuZ�B����b@��V*t��DҾ��T�z�^�Zu} }�fk��y��LQ�� �u����
Behavioral task
behavioral1
Sample
898ee4c34da222f5f4fb00f9a08b9df7_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
898ee4c34da222f5f4fb00f9a08b9df7_JaffaCakes118
-
Size
524KB
-
MD5
898ee4c34da222f5f4fb00f9a08b9df7
-
SHA1
e4ec8bf179ef07ae5918e18258fbe39901b7c452
-
SHA256
e4fed60e27669a72de9240b976653029c36d8e85c659c84a2af6538ecdd05b8e
-
SHA512
a83a52bea9eca0ca911deeb377f8865f65aecedde650f7ed55a7fe7ac34ed1ce47fcf3310e222b6b508e57860124f8bd3e29e5e8cf4ec0ea78fa561db0c08ef6
-
SSDEEP
12288:9S7o/PT7Unt1HpQu4KADdJnhz9JNBQ3eLL2zCvFC:9Xnu1JnqVNGT2vFC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 898ee4c34da222f5f4fb00f9a08b9df7_JaffaCakes118
Files
-
898ee4c34da222f5f4fb00f9a08b9df7_JaffaCakes118.exe windows:4 windows x86 arch:x86
054987616fb6560b251e6c6f1f9cb8f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupDiDestroyDeviceInfoList
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
shell32
ShellExecuteExW
ole32
CoCreateInstance
advapi32
RegQueryValueExW
wsock32
__WSAFDIsSet
dbghelp
MiniDumpWriteDump
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 474KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 516KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE